Questions and straight answers
The questions below are the ones this desk is built around. Each answer gives the mechanism first and states its own limits — this is general information about how the rules usually work, not legal advice for your jurisdiction.
Field 01What is held
What data does a gambling account hold about me?
A licensed operator typically holds a handful of distinct categories: identity data (name, date of birth, address and the document data checked when you verified), account and login data (email, a hashed password, security settings, device and session records), activity and transaction data (deposits, withdrawals, stakes and game or market history), source-of-funds or source-of-wealth evidence where a larger balance or a regulatory duty calls for it, safer-gambling data (limits, self-exclusion and cooling-off entries), and a record of the consents and terms versions you accepted with their timestamps. Most of it exists because a licence or an anti-money-laundering duty requires it, not because the operator chose to collect it, and the privacy notice that applies to your account is the authoritative list.
What is the difference between consent and a contractual basis?
Consent is one of several lawful bases for processing, and it means you chose to allow a specific use and can withdraw that choice as easily as you gave it. A contractual basis means the processing is necessary to provide the service you asked for, so it is not something you can consent away — you cannot, for example, insist that the operator not process your deposits and still use the account. The practical consequence is that “we may use your data to run your account” is usually contractual and stays, while “we may email you offers” is usually consent and can be switched off. Marketing consent is the one to look for, and withdrawing it should not close the account.
Field 02Access and the response clock
How do I ask a casino what data it holds about me?
You make a subject access request: a clear message to the operator (or its data-protection contact, which its privacy notice names) asking for a copy of the personal data it holds about you and for the information that goes with it — the purposes, the categories, the recipients and the retention period. You do not need a special form or a reason, though the operator may ask you to prove who you are before it answers, and it may extend the response clock once if the request is complex. Doing it in writing from the email address on the account, naming the data you want and the date, is the version that is easiest to enforce if the reply is late.
How long does an operator have to answer an access request?
Under the general model that most data-protection regimes follow — the one the EU and UK GDPR codified and that many other jurisdictions mirror — the operator must answer without undue delay and in any case within one month of receiving the request and any identity evidence it reasonably needs. That month can be extended, typically by up to two further months, where the request is genuinely complex or you have made several; if it extends the clock it must tell you within the first month and explain why. The clock does not start until it can confirm who is asking, so prompt identity confirmation is the practical way to keep the month short.
Field 03Erasure and consent
Can a casino refuse to erase my data when I ask?
Often it can lawfully refuse part of an erasure request, and it should tell you which part and why. The right to erasure is not absolute: where an operator must keep records to meet a legal obligation — commonly anti-money-laundering and licensing record-keeping, which often carries a fixed minimum retention period — that data is held and the erasure request does not remove it. What erasure can usually reach is data held for purposes that have ended, such as marketing profiles or old session logs. A refusal of the whole request with no legal ground, and no explanation, is a different thing from a lawful retention, and it is the version worth escalating to the regulator.
Who else receives my gambling account data?
Beyond the operator, a set of processors and recipients commonly handle parts of it: payment providers, identity-verification and anti-fraud services, the sports-data and game suppliers behind the products, cloud and email providers, analytics, and — where the law requires it — regulators, tax authorities and law-enforcement bodies. The operator’s privacy notice should name or categorise these recipients, and international transfers should be covered by a lawful transfer mechanism. A recipient list is one of the items a subject access request is entitled to, so you can ask for the categories even if the notice is vague.
Field 04Portability and recipients
Can I move my gambling data to another operator?
Data portability gives you a right to receive the personal data you provided in a structured, commonly used, machine-readable format and, where technically feasible, to have it sent to another controller. What travels is your provided data — the account details and the activity you supplied — and not every internal record, and the right attaches to processing based on consent or a contract. For most gambling accounts, portability is more useful as a way to get a clean export of your own history than as a way to switch operators, because the second operator still has to verify you from scratch under its own licence and cannot simply inherit the first operator’s verification.
What happens to my data if I close my account?
Closing an account stops new activity but does not, by itself, delete the data. The operator usually retains the transaction, identity and safer-gambling records for the period its licence and anti-money-laundering duties require, and deletes or anonymises the rest on a schedule. Some data, such as a self-exclusion marker, is often kept for longer precisely so that it keeps working. The practical points are that closure is not erasure, that a later erasure request can reach only the data no legal duty requires it to keep, and that the account’s privacy notice should state the periods.
Field 05Closure, passwords and breaches
Is my password stored by the operator?
Not as a password. A competent operator stores a one-way hash of your password — a value computed from it that cannot be turned back into the password — usually with a per-user salt and a slow hashing function, and it compares the hash of what you type at login against the stored one. What this means practically is that an operator should never be able to tell you your password, only reset it, and that an email that shows you your own password is a sign of insecure storage. You can ask, through an access request, for the categories of data held; the password itself is not something the operator can produce.
What should I do if my gambling data is breached?
Treat a breach notice as a signal to change the password on that account and on any other account that reused it, to turn on a second factor, and to watch for phishing that quotes the breached details convincingly. Where a breach is likely to result in a high risk to your rights, the operator is generally required to tell you without undue delay, and it must tell its regulator within a short window; the notice should say what was affected and what it is doing. Beyond that, the ordinary route applies: the operator’s data-protection contact, then its regulator, and a complaint to the data-protection authority where you live if the response is inadequate.
Affiliate disclosure and risk warning
Every affiliate link on this page and in the header is a sponsored link to a partner operator, and we may be paid if you open an account through it, at no extra cost to you. That link pays us; it does not improve any decision, it is not a ranking, and it is never a recommendation to play. Nothing on this page is legal, financial, tax or data-protection advice, and nothing here is a prediction about any event or market, or a view on any operator. 18+ only. Every stake is money at risk and can be lost in full. The data rights explained here — access, rectification, erasure, portability, objection, restriction, consent and retention — are general descriptions of how the mechanisms usually work, not a statement of the law that applies to you: data-protection and record-keeping rules differ between countries, states and provinces and change over time, and an operator may lawfully hold data that a rights request cannot remove, because a licence or anti-money-laundering duty requires it. This page does not name any operator and is not a substitute for that operator’s privacy notice or for advice from a data-protection authority or a qualified adviser. Never stake money you cannot afford to lose, never borrow to play, and never chase losses with a larger stake. Gambling can cause serious financial harm, including debt and damage to relationships and mental health. Free and confidential support is available in most countries through national gambling-harm helplines, for players and for the people around them.